Ref: Vau96a

Abstract:Blowfish is a sixteen-rounds Feistel cipher in which the F function is a part of the private key. In this paper, we show that the disclosure of F allows to perform a differential cryptanalysis which can recover all the rest of the key with 2 48 chosen plaintexts against a number of rounds reduced to eight. Moreover, for some weak F function, this attack only needs 2 23 chosen plaintexts against eight rounds, and 3x2 51 chosen plaintexts against sixteen-rounds. When the F function is safely kept private, one can detect whether it is weak or not with a differential attack using 2 22 plaintexts against eight rounds.